CVE-2024-24695: 
NixOS vulnerability analysis and mitigation

Improper input validation vulnerability (CVE-2024-24695) was discovered in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows. The vulnerability was reported by researcher shmoul and disclosed on February 13, 2024. The affected products include Zoom Desktop Client for Windows versions before 5.17.0, Zoom VDI Client for Windows versions before 5.17.5 (excluding 5.15.15 and 5.16.12), and Zoom Meeting SDK for Windows versions before 5.17.0 (Zoom Bulletin).

The vulnerability has been assigned a CVSS v3.1 base score of 6.8 (Medium severity) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N. This scoring indicates that the vulnerability requires network access and low privileges for exploitation, with user interaction required. The impact is primarily focused on confidentiality, with no direct impact on integrity or availability (Zoom Bulletin).

The vulnerability could allow an authenticated user to conduct a disclosure of information through network access. This means that successful exploitation could lead to unauthorized access to sensitive information (Zoom Bulletin).

Users are advised to update to the latest versions of the affected products to mitigate this vulnerability. The fixed versions are Zoom Desktop Client for Windows version 5.17.0 or later, Zoom VDI Client for Windows version 5.17.5 or later, and Zoom Meeting SDK for Windows version 5.17.0 or later. Updates can be obtained from the official Zoom download page (Zoom Bulletin).